America.gov launches as an AI front door to federal services, with Login.gov as its sign-in
GSA and the White House National Design Studio launched America.gov, an AI-assisted entry point to federal services. The executive order behind it makes Login.gov the authentication service and commits to no central citizen database. Transactions arrive in 2027, and the identity rules for them are still to be written.
The General Services Administration and the White House National Design Studio launched America.gov on September 29, 2026, a conversational entry point that answers plain-language questions about federal services and routes people to the right agency across more than 29,000 federal websites. Newsweek reports it runs on Google's Gemini and Grok. An executive order signed the same day directs GSA to use Login.gov as America.gov's authentication service and tells agencies to complete their own Login.gov integration. It commits to data minimization, "auditable authorization", and no centralized federal system of records, and keeps in-person, phone and mail channels open. Today the site only answers and routes; enrolling in Medicare, applying for passports and applying for federal jobs are planned for 2027. OMB owes agencies implementation guidance within 90 days, by December 28.
Why it matters
The order's identity decision is more consequential than its model choice. The statute it cites, 6 U.S.C. 1523(b)(1)(D), already required agencies to implement the single sign-on platform GSA develops for any public website that needs authentication, so America.gov turns an existing mandate into a deadline with a front end attached. Login.gov had more than 100 million accounts as of July.
The security questions arrive with transactions. A single front door to every federal benefit will be the most impersonated login page in the country, so sign-in should default to phishing-resistant MFA such as passkeys, not SMS codes. Identity proofing should match each transaction under NIST SP 800-63, with the strongest checks on payment and address changes. Authorization should be requested per agency at the moment of use rather than held as standing access. And the AI may draft and route but must never approve: anything that reads untrusted content can be steered by injected instructions, so every consequential action needs explicit confirmation from the authenticated person. President Trump said the site "cannot in theory be hacked into"; no independent security assessment has been published. Watch the OMB memo for whether it requires phishing-resistant sign-in for transactions.
We cover the order section by section in America.gov explained: why the identity layer matters more than the chatbot. For a walkthrough of what the service does today and how other governments approached the same problem, read Deepak Gupta's America.gov Explained: What It Is, How to Use It, and What Comes Next.
Sources: White House executive order, GSA, Newsweek. Reference: Deepak Gupta, America.gov Explained.
Related on Start with Identity
- BlogDigiD DDoS shows how little availability headroom the Dutch national login has left
A DDoS attack on October 30 left DigiD only partly reachable for about 90 minutes, blocking logins to the Dutch tax office and MijnOverheid. Government figures
- BlogGOV.UK One Login opens passkeys to 23 million users, and is saving 600 pounds a day on SMS
After a 300,000-user trial, GOV.UK One Login is offering passkeys to more than 23 million people across childcare, driving licences, State Pension and tax servi
- BlogFIDO Alliance to publish its wallet certification documents and opens a forum for issuers and regulators
At Authenticate 2026 on October 20, the FIDO Alliance said it will publish the Credential Manager Reference Architecture and a Framework for Verifier Identifica
- RecipeAdd login to a Next.js app with OIDC
A complete, copy-paste OpenID Connect login for the Next.js App Router using authorization code flow with PKCE, server-side token exchange, and httpOnly cookies
- RankingBest Identity Tools for Financial Services: Top 5
The top 5 identity tools for financial services (Microsoft Entra ID, CyberArk, now Idira, SailPoint, Okta, Silverfort), chosen for regulation, privileged risk,
- CVECheck Point SmartConsole login hands an unauthenticated attacker an admin token
A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a